MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b041e6269143175c32737be0345fca5574039cc8df37f06effdd93131a3b8dd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b041e6269143175c32737be0345fca5574039cc8df37f06effdd93131a3b8dd5
SHA3-384 hash: c2bf788304a7bd581a7fa3cb247a05cfe1f3a5e50c0d346c01367c7974d5815862762e69f419895b6346098046df8dbb
SHA1 hash: 2b35605f1f4b56c00418cceb41769e2960c96d6a
MD5 hash: b1e31f17ca961a21cde37ea89c819b2d
humanhash: oscar-cup-golf-tennessee
File name:b041e6269143175c32737be0345fca5574039cc8df37f06effdd93131a3b8dd5
Download: download sample
File size:5'330'176 bytes
First seen:2021-07-13 06:48:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 93a138801d9601e4c36e6274c8b9d111 (11 x CobaltStrike, 9 x Snatch, 8 x LaplasClipper)
ssdeep 49152:f/sHYnflBMdfILfjx/x6cdR+lMO7FDY/7a1B7ykN/05TUTDDy2j3yXBQWz5g+AYX:nskHMObnpOhDY/gi6TvPjl+AA
Threatray 173 similar samples on MalwareBazaar
TLSH T12A364B07FCA605F9C6BEF5348652A3227A71786943313BD31F949A7A1626FE07A3D310
Reporter JAMESWT_WT
Tags:exe Happytuk Co.Ltd. signed

Code Signing Certificate

Organisation:Happytuk Co.,Ltd.
Issuer:Symantec Class 3 SHA256 Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2018-09-06T00:00:00Z
Valid to:2021-10-05T23:59:59Z
Serial number: 0ed4df1033393ff2af41c571a6aa19d7
Intelligence: 6 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: f78de1e59df2eac7901d4fa7d66e9818204a5c4c9b630bb2ff9439c2dea8b5b5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b041e6269143175c32737be0345fca5574039cc8df37f06effdd93131a3b8dd5
Verdict:
Malicious activity
Analysis date:
2021-07-13 06:51:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f3509add-82d7-4c77-9eb5-2904d05327a9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/171253/
Detection(s):
SecuriteInfo.com.HTML-10660.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cb1d1ec6-c2d9-40af-90cc-c3814649d7d0
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
36 / 100
Link:
https://www.joesandbox.com/analysis/815322
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b041e6269143175c32737be0345fca5574039cc8df37f06effdd93131a3b8dd5/
Threat name:
Win64.Trojan.Badur
Create hunting rule
Status:
Malicious
First seen:
2021-07-10 04:16:16 UTC
File Type:
PE+ (Exe)
Extracted files:
5
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0b16dfa3e0bbcc7b04a9a43309e911059a4d8c5892b1068e0441b177960d3eee
3195c355aa564ea66b4b37baa9547cb53dde7cf4ae7010256db92fff0bde873d
36e3fcd6a4c7c9db985be77ea6394b2ed019332fdae4739df2f96a541ea52617
69d930050b2445937ec6a4f9887296928bf663f7a71132676be3f112e80fe275
7f4e02a041ca7cfbdc79b96a890822fd7c37be67b1f6c9e07596e6aec57ccdc0
8445c0189735766edf0e3d01b91f6f98563fef272ac5c92d3701a1174ad072dd
bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975
bf4f50979b7b29f2b6d192630b8d7b76adb9cb65157a1c70924a47bf519c4edd
e4109875e84b3e9952ef362abc5b826c003b3d0b1b06d530832359906b0b8831
fb812a2ccdab0a9703e8e4e12c479ff809a72899374c1abf06aef55abbbf8edc
+ 163 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210713-4b5tjcjsq6/
Behaviour
GoLang User-Agent
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
b041e6269143175c32737be0345fca5574039cc8df37f06effdd93131a3b8dd5
MD5 hash:
b1e31f17ca961a21cde37ea89c819b2d
SHA1 hash:
2b35605f1f4b56c00418cceb41769e2960c96d6a
Link:
https://www.unpac.me/results/f8de1a33-ba8c-43a6-a0f6-ea787e01f9df/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b041e6269143175c32737be0345fca5574039cc8df37f06effdd93131a3b8dd5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/171253/

Comments